blackmoon | 70baf4d5b0d1364546db64b63a5c56c4774d31911f19a5f588fea8888d962604

General

Target

NEAS.70baf4d5b0d1364546db64b63a5c56c4774d31911f19a5f588fea8888d962604_JC.exe
Size

14.7MB
MD5

b8af4b75121ac6143f3ed94ac4e2948b
SHA1

a9deac560df683bbd9fb76bae7d3421ce3c698c9
SHA256

70baf4d5b0d1364546db64b63a5c56c4774d31911f19a5f588fea8888d962604
SHA512

8fc27c927a62378e774ec33c64f48cf44c65b32bb7ebbd80844a9ffbae180b778d9a9fd7e12e88a415ee73a5e159da4c22da13caae7f96bebaf73f984d44c089
SSDEEP

393216:2Ws9BysSToqOsg4lUBF2CWzrCDmV5ZNcm4RupHVoTf2TE7/QWhtOG:jsKroqOsg4lI1ZmURMpHctl

Score

10^/10

blackmoon banker trojan vmprotect

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 3 IoCs

resource	yara_rule
behavioral1/memory/2140-4-0x0000000000400000-0x00000000021C8000-memory.dmp	family_blackmoon
behavioral1/memory/2140-10-0x0000000000400000-0x00000000021C8000-memory.dmp	family_blackmoon
behavioral1/memory/2140-46-0x0000000000400000-0x00000000021C8000-memory.dmp	family_blackmoon

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2140-4-0x0000000000400000-0x00000000021C8000-memory.dmp	vmprotect
behavioral1/memory/2140-10-0x0000000000400000-0x00000000021C8000-memory.dmp	vmprotect
behavioral1/memory/2140-46-0x0000000000400000-0x00000000021C8000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2140	NEAS.70baf4d5b0d1364546db64b63a5c56c4774d31911f19a5f588fea8888d962604_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TypedURLs	NEAS.70baf4d5b0d1364546db64b63a5c56c4774d31911f19a5f588fea8888d962604_JC.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2140	NEAS.70baf4d5b0d1364546db64b63a5c56c4774d31911f19a5f588fea8888d962604_JC.exe
2140	NEAS.70baf4d5b0d1364546db64b63a5c56c4774d31911f19a5f588fea8888d962604_JC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2140	NEAS.70baf4d5b0d1364546db64b63a5c56c4774d31911f19a5f588fea8888d962604_JC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2140	NEAS.70baf4d5b0d1364546db64b63a5c56c4774d31911f19a5f588fea8888d962604_JC.exe
2140	NEAS.70baf4d5b0d1364546db64b63a5c56c4774d31911f19a5f588fea8888d962604_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.70baf4d5b0d1364546db64b63a5c56c4774d31911f19a5f588fea8888d962604_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.70baf4d5b0d1364546db64b63a5c56c4774d31911f19a5f588fea8888d962604_JC.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2140-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2140-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2140-4-0x0000000000400000-0x00000000021C8000-memory.dmp

Filesize
29.8MB

Download
memory/2140-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2140-6-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2140-8-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2140-10-0x0000000000400000-0x00000000021C8000-memory.dmp

Filesize
29.8MB

Download
memory/2140-11-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2140-14-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2140-16-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2140-19-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2140-21-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2140-24-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2140-26-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2140-31-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2140-29-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2140-32-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2140-34-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2140-36-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2140-38-0x0000000077650000-0x0000000077651000-memory.dmp

Filesize
4KB

Download
memory/2140-37-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2140-40-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2140-42-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2140-46-0x0000000000400000-0x00000000021C8000-memory.dmp

Filesize
29.8MB

Download

Analysis

Sharing